NixOS · vcunat · Sep 9, 2025 · Aug 24, 2025 · Aug 24, 2025 · Aug 24, 2025
diff --git a/doc/hooks/installShellFiles.section.md b/doc/hooks/installShellFiles.section.md
@@ -42,12 +42,43 @@ The manpages must have a section suffix, and may optionally be compressed (with
 {
   nativeBuildInputs = [ installShellFiles ];
 
-  # Sometimes the manpage file has an undesirable name; e.g., it conflicts with
-  # another software with an equal name. It should be renamed before being
-  # installed via installManPage
+  # Sometimes the manpage file has an undersirable name; e.g., it conflicts with
+  # another software with an equal name. To install it with a different name,
+  # the installed name must be provided before the path to the file.
+  #
+  # Below install a manpage "foobar.1" from the source file "./foobar.1", and
+  # also installs the manpage "fromsea.3" from the source file "./delmar.3".
   postInstall = ''
-    mv fromsea.3 delmar.3
-    installManPage foobar.1 delmar.3
+    installManPage \
+        foobar.1 \
+        --name fromsea.3 delmar.3
+  '';
+}
+```
+
+The manpage may be the result of a piped input (e.g. `<(cmd)`), in which
+case the name must be provided before the pipe with the `--name` flag.
+
+```nix
+{
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installManPage --name foobar.1 <($out/bin/foobar --manpage)
+  '';
+}
+```
+
+If no parsing of arguments is desired, pass `--` to opt-out of all subsequent
+arguments.
+
+```nix
+{
+  nativeBuildInputs = [ installShellFiles ];
+
+  # Installs a manpage from a file called "--name"
+  postInstall = ''
+    installManPage -- --name
   '';
 }
 ```
@@ -58,8 +89,8 @@ The `installShellCompletion` function takes one or more paths to shell
 completion files.
 
 By default it will autodetect the shell type from the completion file extension,
-but you may also specify it by passing one of `--bash`, `--fish`, or
-`--zsh`. These flags apply to all paths listed after them (up until another
+but you may also specify it by passing one of `--bash`, `--fish`, `--zsh`, or
+`--nushell`. These flags apply to all paths listed after them (up until another
 shell flag is given). Each path may also have a custom installation name
 provided by providing a flag `--name NAME` before the path. If this flag is not
 provided, zsh completions will be renamed automatically such that `foobar.zsh`
@@ -77,9 +108,10 @@ zsh).
     # explicit behavior
     installShellCompletion --bash --name foobar.bash share/completions.bash
     installShellCompletion --fish --name foobar.fish share/completions.fish
+    installShellCompletion --nushell --name foobar share/completions.nu
     installShellCompletion --zsh --name _foobar share/completions.zsh
     # implicit behavior
-    installShellCompletion share/completions/foobar.{bash,fish,zsh}
+    installShellCompletion share/completions/foobar.{bash,fish,zsh,nu}
   '';
 }
 ```
@@ -104,6 +136,7 @@ failure. To prevent this, guard the completion generation commands.
     installShellCompletion --cmd foobar \
       --bash <($out/bin/foobar --bash-completion) \
       --fish <($out/bin/foobar --fish-completion) \
+      --nushell <($out/bin/foobar --nushell-completion) \
       --zsh <($out/bin/foobar --zsh-completion)
   '';
 }

diff --git a/doc/languages-frameworks/go.section.md b/doc/languages-frameworks/go.section.md
@@ -192,6 +192,12 @@ Specifies the contents of the `go.sum` file and triggers rebuilds when it change
 
 Defaults to `null`
 
+### `buildTestBinaries` {#var-go-buildTestBinaries}
+
+This option allows to compile test binaries instead of the usual binaries produced by a package.
+Go can [compile test into binaries](https://pkg.go.dev/cmd/go#hdr-Test_packages) using the `go test -c` command.
+These binaries can then be executed at a later point (outside the Nix sandbox) to run the tests.
+This is mostly useful for downstream consumers to run integration or end-to-end tests that won't work in the Nix sandbox, for example because they require network access.
 
 ## Versioned toolchains and builders {#ssec-go-toolchain-versions}
 

diff --git a/doc/redirects.json b/doc/redirects.json
@@ -574,6 +574,9 @@
   "strictflexarrays3": [
     "index.html#strictflexarrays3"
   ],
+  "glibcxxassertions": [
+    "index.html#glibcxxassertions"
+  ],
   "tester-shfmt": [
     "index.html#tester-shfmt"
   ],
@@ -622,6 +625,9 @@
   "typst-package-scope-and-usage": [
     "index.html#typst-package-scope-and-usage"
   ],
+  "var-go-buildTestBinaries": [
+    "index.html#var-go-buildTestBinaries"
+  ],
   "var-meta-teams": [
     "index.html#var-meta-teams"
   ],

diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
@@ -22,6 +22,8 @@
 
 - The `offrss` package was removed due to lack of upstream maintenance since 2012. It's recommended for users to migrate to another RSS reader
 
+- `installShellFiles`: Allow installManPage to take a piped input, add the `--name` flag for renaming the file when installed. Can also append `--` to opt-out of all subsequent parsing.
+
 - GCC 9, 10, 11, and 12 have been removed, as they have reached end‐of‐life upstream and are no longer supported.
 
 - GHCJS 8.10, exposed via `haskell.compiler.ghcjs` and `haskell.compiler.ghcjs810`, has been removed. Downstream users should migrate their projects to the new JavaScript backend of GHC proper which can be used via `pkgsCross.ghcjs` from Nixpkgs. Haskell packaging code, like `haskellPackages.mkDerivation`, `ghcWithPackages` and `hoogleWithPackages`, also no longer supports GHCJS.
@@ -50,6 +52,8 @@
 
 - `kbd` package's `outputs` now include a `man` and `scripts` outputs. The `unicode_start` and `unicode_stop` Bash scripts are now part of the `scripts` output, allowing most usages of the `kbd` package to not pull in `bash`.
 
+- `spidermonkey_91` has been removed, as it has been EOL since September 2022.
+
 - `cudaPackages.cudatoolkit-legacy-runfile` has been removed.
 
 - `conduwuit` was removed due to upstream ceasing development and deleting their repository. For existing data, a migration to `matrix-conduit`, `matrix-continuwuity` or `matrix-tuwunel` may be possible.
@@ -64,6 +68,8 @@
 
 - `gnome-keyring` no longer ships with an SSH agent anymore because it has been deprecated upstream. You should use `gcr_4` instead, which provides the same features. More information on why this was done can be found on [the relevant GCR upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67).
 
+- `python3Full` and its versioned attributes (python3xxFull) have been removed. Bluetooth support is now enabled in the default python3 attributes. The X11 support built the tkinter module, which is available as a dedicated attribute on the package set.
+
 - `stdenv.mkDerivation` and other derivation builders that use it no longer allow the value of `env` to be anything but an attribute set, for the purpose of setting environment variables that are available to the [builder](https://nix.dev/manual/nix/latest/store/derivation/#builder) process. An environment variable called `env` can still be provided by means of `mkDerivation { env.env = ...; }`, though we recommend to use a more specific name than "env".
 
 - The default Android NDK version has been raised to 27, and the default SDK version to 35.
@@ -155,6 +161,8 @@
 
 - [`homebox` 0.20.0](https://github.com/sysadminsmedia/homebox/releases/tag/v0.20.0) changed how assets are stored and hashed. It is recommended to back up your database before this update.
 
+- `installShellCompletion`: now supports Nushell completion files
+
 - New hardening flags, `strictflexarrays1` and `strictflexarrays3` were made available, corresponding to the gcc/clang options `-fstrict-flex-arrays=1` and `-fstrict-flex-arrays=3` respectively.
 
 - `gramps` has been updated to 6.0.0
@@ -171,6 +179,8 @@
 - `searx` was updated to use `envsubst` instead of `sed` for parsing secrets from environment variables.
   If your previous configuration included a secret reference like `server.secret_key = "@SEARX_SECRET_KEY@"`, you must migrate to the new envsubst syntax: `server.secret_key = "$SEARX_SECRET_KEY"`.
 
+- A new hardening flag, `glibcxxassertions` was made available, corresponding to the glibc `_GLIBCXX_ASSERTIONS` option.
+
 - `versionCheckHook`: Packages that previously relied solely on `pname` to locate the program used to version check, but have a differing `meta.mainProgram` entry, might now fail.
 
 

diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
@@ -1682,6 +1682,12 @@ This should be turned off or fixed for build errors such as:
 sorry, unimplemented: __builtin_clear_padding not supported for variable length aggregates
 ```
 
+#### `glibcxxassertions` {#glibcxxassertions}
+
+Adds the `-D_GLIBCXX_ASSERTIONS` compiler flag. This flag only has an effect on libstdc++ targets, and when defined, enables extra error checking in the form of precondition assertions, such as bounds checking in c++ strings and null pointer checks when dereferencing c++ smart pointers.
+
+These checks may have an impact on performance in some cases.
+
 #### `pacret` {#pacret}
 
 This flag adds the `-mbranch-protection=pac-ret` compiler option on aarch64-linux targets. This uses ARM v8.3's Pointer Authentication feature to sign function return pointers before adding them to the stack. The pointer's authenticity is then validated before returning to its destination. This dramatically increases the difficulty of ROP exploitation techniques.

diff --git a/lib/licenses.nix b/lib/licenses.nix
@@ -64,6 +64,11 @@ lib.mapAttrs mkLicense (
       free = false;
     };
 
+    adobeUtopia = {
+      fullName = "Adobe Utopia Font License";
+      spdxId = "Adobe-Utopia";
+    };
+
     afl20 = {
       spdxId = "AFL-2.0";
       fullName = "Academic Free License v2.0";
@@ -692,6 +697,11 @@ lib.mapAttrs mkLicense (
       spdxId = "HPND-sell-variant";
     };
 
+    hpndDec = {
+      fullName = "Historical Permission Notice and Disclaimer - DEC variant";
+      spdxId = "HPND-DEC";
+    };
+
     hpndDoc = {
       fullName = "Historical Permission Notice and Disclaimer - documentation variant";
       spdxId = "HPND-doc";

diff --git a/nixos/modules/config/console.nix b/nixos/modules/config/console.nix
@@ -195,7 +195,6 @@ in
             "${config.boot.initrd.systemd.package}/lib/systemd/systemd-vconsole-setup"
             "${config.boot.initrd.systemd.package.kbd}/bin/setfont"
             "${config.boot.initrd.systemd.package.kbd}/bin/loadkeys"
-            "${config.boot.initrd.systemd.package.kbd.gzip}/bin/gzip" # Fonts and keyboard layouts are compressed
           ]
           ++ lib.optionals (cfg.font != null && lib.hasPrefix builtins.storeDir cfg.font) [
             "${cfg.font}"

diff --git a/nixos/tests/sssd-ldap.nix b/nixos/tests/sssd-ldap.nix
@@ -99,6 +99,7 @@ import ./make-test-python.nix (
               objectClass: posixAccount
               userPassword: ${testPassword}
               homeDirectory: /home/${testUser}
+              loginShell: /run/current-system/sw/bin/bash
               uidNumber: 1234
               gidNumber: 1234
               cn: ""

diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.33.0";
+  version = "1.33.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-IpDjrt5vTRY+GhdFIWWvM8qtS18JSPmUKc+i2Dhfqp0=";
+    hash = "sha256-LFT6u/ppbc6PmxN8jvekKaBh+P5jPNfQpRGAmFXywhk=";
   };
 
   outputs = [

diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1566";
+  version = "9.1.1623";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-/hzyjFGjl8Wu9tHtFgnnHtGbcJ5AIjCMUNCScrdIgwU=";
+    hash = "sha256-T7epi6ex9AU4iV/ClSeKlK3T0V0WajiVxnDVevkqaw8=";
   };
 
   enableParallelBuilding = true;

diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation rec {
     hash = "sha256-KSS8s6Hti1UfwQH3QLnw/gogKxFQJ2R89phQ1l/YjFI=";
   };
 
+  patches = [
+    # See: <https://github.com/RsyncProject/rsync/pull/790>
+    ./fix-tests-in-darwin-sandbox.patch
+  ];
+
   nativeBuildInputs = [
     updateAutotoolsGnuConfigScriptsHook
     perl
@@ -75,6 +80,8 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "Fast incremental file transfer utility";
     homepage = "https://rsync.samba.org/";

diff --git a/pkgs/applications/networking/sync/rsync/fix-tests-in-darwin-sandbox.patch b/pkgs/applications/networking/sync/rsync/fix-tests-in-darwin-sandbox.patch
@@ -0,0 +1,56 @@
+From 9b104ed9859f17b6ed4c4ad01806c75a0c197dd7 Mon Sep 17 00:00:00 2001
+From: Emily <hello@emily.moe>
+Date: Tue, 5 Aug 2025 15:55:24 +0100
+Subject: [PATCH] Allow `ls(1)` to fail in test setup
+
+This can happen when the tests are unable to `stat(2)` some files in
+`/etc`, `/bin`, or `/`, due to Unix permissions or other sandboxing. We
+still guard against serious errors, which use exit code 2.
+---
+ testsuite/longdir.test | 4 ++--
+ testsuite/rsync.fns    | 8 ++++----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/testsuite/longdir.test b/testsuite/longdir.test
+index 8d66bb5f..26747292 100644
+--- a/testsuite/longdir.test
++++ b/testsuite/longdir.test
+@@ -16,9 +16,9 @@ makepath "$longdir" || test_skipped "unable to create long directory"
+ touch "$longdir/1" || test_skipped "unable to create files in long directory"
+ date > "$longdir/1"
+ if [ -r /etc ]; then
+-    ls -la /etc >"$longdir/2"
++    ls -la /etc >"$longdir/2" || [ $? -eq 1 ]
+ else
+-    ls -la / >"$longdir/2"
++    ls -la / >"$longdir/2" || [ $? -eq 1 ]
+ fi
+ checkit "$RSYNC --delete -avH '$fromdir/' '$todir'" "$fromdir/" "$todir"
+
+diff --git a/testsuite/rsync.fns b/testsuite/rsync.fns
+index 2ab97b69..f7da363f 100644
+--- a/testsuite/rsync.fns
++++ b/testsuite/rsync.fns
+@@ -195,15 +195,15 @@ hands_setup() {
+     echo some data > "$fromdir/dir/subdir/foobar.baz"
+     mkdir "$fromdir/dir/subdir/subsubdir"
+     if [ -r /etc ]; then
+-	ls -ltr /etc > "$fromdir/dir/subdir/subsubdir/etc-ltr-list"
++	ls -ltr /etc > "$fromdir/dir/subdir/subsubdir/etc-ltr-list" || [ $? -eq 1 ]
+     else
+-	ls -ltr / > "$fromdir/dir/subdir/subsubdir/etc-ltr-list"
++	ls -ltr / > "$fromdir/dir/subdir/subsubdir/etc-ltr-list" || [ $? -eq 1 ]
+     fi
+     mkdir "$fromdir/dir/subdir/subsubdir2"
+     if [ -r /bin ]; then
+-	ls -lt /bin > "$fromdir/dir/subdir/subsubdir2/bin-lt-list"
++	ls -lt /bin > "$fromdir/dir/subdir/subsubdir2/bin-lt-list" || [ $? -eq 1 ]
+     else
+-	ls -lt / > "$fromdir/dir/subdir/subsubdir2/bin-lt-list"
++	ls -lt / > "$fromdir/dir/subdir/subsubdir2/bin-lt-list" || [ $? -eq 1 ]
+     fi
+
+ #      echo testing head:
+-- 
+2.50.1
+
diff --git a/pkgs/applications/version-management/git/default.nix b/pkgs/applications/version-management/git/default.nix
@@ -60,7 +60,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.50.1";
+  version = "2.51.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [
     CGI
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
         }.tar.xz"
       else
         "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-fj5sNt7L2PHu3RTULbZnS+A2ccIgSGS++ipBdWxcj8Q=";
+    hash = "sha256-YKfCJRzC5YjVzYe65WcmBhfG3gwi3KnNv8TH0riZC2I=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
@@ -120,6 +120,8 @@ stdenv.mkDerivation (finalAttrs: {
     # Fix references to gettext introduced by ./git-sh-i18n.patch
     substituteInPlace git-sh-i18n.sh \
         --subst-var-by gettext ${gettext}
+    substituteInPlace contrib/credential/libsecret/Makefile \
+        --replace-fail 'pkg-config' "$PKG_CONFIG"
   ''
   + lib.optionalString doInstallCheck ''
     # ensure we are using the correct shell when executing the test scripts
@@ -299,12 +301,6 @@ stdenv.mkDerivation (finalAttrs: {
     cp -a contrib $out/share/git/
     mkdir -p $out/share/bash-completion/completions
     ln -s $out/share/git/contrib/completion/git-prompt.sh $out/share/bash-completion/completions/
-    # only readme, developed in another repo
-    rm -r contrib/hooks/multimail
-    mkdir -p $out/share/git-core/contrib
-    cp -a contrib/hooks/ $out/share/git-core/contrib/
-    substituteInPlace $out/share/git-core/contrib/hooks/pre-auto-gc-battery \
-      --replace ' grep' ' ${gnugrep}/bin/grep' \
 
     # grep is a runtime dependency, need to patch so that it's found
     substituteInPlace $out/libexec/git-core/git-sh-setup \

diff --git a/pkgs/applications/version-management/git/git-send-email-honor-PATH.patch b/pkgs/applications/version-management/git/git-send-email-honor-PATH.patch
@@ -1,29 +1,25 @@
 diff --git a/Documentation/git-send-email.adoc b/Documentation/git-send-email.adoc
-index 7f223db42d..7e46a07d31 100644
+index 5d13a856a7..5c9978c1e4 100644
 --- a/Documentation/git-send-email.adoc
 +++ b/Documentation/git-send-email.adoc
-@@ -177,7 +177,7 @@ Sending
+@@ -190,7 +190,7 @@ Sending
  	The command will be executed in the shell if necessary.  Default
  	is the value of `sendemail.sendmailCmd`.  If unspecified, and if
- 	--smtp-server is also unspecified, git-send-email will search
--	for `sendmail` in `/usr/sbin`, `/usr/lib` and $PATH.
-+	for `sendmail` in $PATH.
+ 	`--smtp-server` is also unspecified, `git send-email` will search
+-	for `sendmail` in `/usr/sbin`, `/usr/lib` and `$PATH`.
++	for `sendmail` in `$PATH`.
 
  --smtp-encryption=<encryption>::
  	Specify in what way encrypting begins for the SMTP connection.
-@@ -233,9 +233,9 @@ a password is obtained using 'git-credential'.
- --smtp-server=<host>::
+@@ -247,7 +247,7 @@ a password is obtained using linkgit:git-credential[1].
  	If set, specifies the outgoing SMTP server to use (e.g.
  	`smtp.example.com` or a raw IP address).  If unspecified, and if
--	`--sendmail-cmd` is also unspecified, the default is to search
--	for `sendmail` in `/usr/sbin`, `/usr/lib` and $PATH if such a
--	program is available, falling back to `localhost` otherwise.
-+	`--sendmail-cmd` is also unspecified, the default is to search for
-+	`sendmail` in $PATH if such a program is available, falling back to
-+	`localhost` otherwise.
+ 	`--sendmail-cmd` is also unspecified, the default is to search
+-	for `sendmail` in `/usr/sbin`, `/usr/lib` and `$PATH` if such a
++	for `sendmail` in `$PATH` if such a
+ 	program is available, falling back to `localhost` otherwise.
  +
  For backward compatibility, this option can also specify a full pathname
- of a sendmail-like program instead; the program must support the `-i`
 diff --git a/git-send-email.perl b/git-send-email.perl
 index 798d59b84f..69c9cc2a7d 100755
 --- a/git-send-email.perl